PDF static analysis report

Static analysis result for SHA-256 fb4f147b4a525e56…

SUSPICIOUS

PDF

44.4 KB Created: 2021-06-03 09:46:07 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: a93a1634181fd1e664b8d4e724a34522 SHA-1: e5a10cd13328597a1d20545e90ae0a56fc1cde51 SHA-256: fb4f147b4a525e56f346890f84b5a89bfc69b19de5099f66ec3a8e5abd48010f
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous URLs pointing to sites offering game hacks and cheats, indicating a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were directly extracted, the presence of embedded URLs and the document's content strongly suggest it's part of a social engineering campaign to trick users into downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/431946152/roblox-hack-unlimited-robux-game-hack PDF link annotation
    • http://handimanlibrary.org/repository/hackear-coin-master-sin-root_GM406889139.pdfIn PDF document text
    • http://handimanlibrary.org/repository/moonactive-free-spins_GM406889139.pdfIn PDF document text
    • http://handimanlibrary.org/repository/coin-master-bonus_GM406889139.pdfIn PDF document text
    • http://handimanlibrary.org/repository/coin-master-card-link-free_GM406889139.pdfIn PDF document text
    • http://handimanlibrary.org/repository/free-roblox-adopt-me-pets_GM431946152.pdfIn PDF document text
    • http://handimanlibrary.org/repository/free-robux-codes-no-human-verification_GM431946152.pdfIn PDF document text
    • http://handimanlibrary.org/repository/rbx-land-free-robux_GM431946152.pdfIn PDF document text
    • http://handimanlibrary.org/repository/coin-master-free-spins-daily_GM406889139.pdfIn PDF document text
    • http://handimanlibrary.org/repository/how-to-get-free-robux-without-doing-anything-2021_GM431946152.pdfIn PDF document text
    • http://handimanlibrary.org/repository/minecraft-java-edition-free-download_GM479516143.pdfIn PDF document text
    • http://handimanlibrary.org/repository/coin-master-hack-version_GM406889139.pdfIn PDF document text
    • http://handimanlibrary.org/repository/coin-master-35-13-hack-download_GM406889139.pdfIn PDF document text
    • http://handimanlibrary.org/repository/moonactive-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://handimanlibrary.org/repository/how-to-get-free-robux-without-downloading-apps-2021_GM431946152.pdfIn PDF document text
    • http://handimanlibrary.org/repository/coin-master-hack-trick-2021_GM406889139.pdfIn PDF document text
    • http://handimanlibrary.org/repository/how-to-get-roblox-premium-for-free_GM431946152.pdfIn PDF document text
    • http://handimanlibrary.org/repository/free-custom-minecraft-skins_GM479516143.pdfIn PDF document text
    • http://handimanlibrary.org/repository/how-to-hack-any-roblox-account_GM431946152.pdfIn PDF document text
    • http://handimanlibrary.org/repository/how-to-get-free-robux-codes_GM431946152.pdfIn PDF document text
    • http://handimanlibrary.org/repository/coin-master-com_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005015.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5015 24604 bytes
SHA-256: 5081f7d57e126c659a2a1c3868c06eb3ad573ce3ff08f3230e46048ff22bd9b8
font_01_sfnt_off0000882d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x882D 19168 bytes
SHA-256: c229ae85f225584a05b8ae3a5d05ef5eb919d65508796bcf435d04f59e516df3

Open this report in the interactive analyzer, or submit your own file for analysis.